If you have not already done so, in the Change Center of the Administration Console, click Lock & Edit (see Use the Change Center).

In the left pane of the Console, under Domain
Structure, select the domain name.

Select Configuration > Log
Filters.

Under Log Filters, click the name of the
log filter for which you want to define a log filter expression.

On the
Settings for [Log Filter Name]: Configuration
page, you can choose to type (or paste) an expression directly, or you
can construct the expression by choosing options from a list. To enter
an expression directly, click Edit.

On the
Settings for [Log Filter Name] > Configuration
page, type or paste the expression directly into the Log
Filter Expressions field. To create a log filter
expression, use the WLDF Query Language.

Click
Finish. If the expression is complete, click
Save. If you want to continue to construct a
more complex expression, go to step 14, below.

On the Settings for [Log Filter Name]:
Configuration page, select an attribute from the
Message Attribute list.

Select an operator from the Operator
list.

Enter a value in the Value field. The
value must be an appropriate value for the message attribute chosen
above.

Click Finish.

If the expression is complete, click Save.
If you want to continue to construct a more complex expression, go to
step 14, below.

Notice that when you write or construct a simple expression under
Current Log Filter Expressions, the expression
is also inserted under Expressions. When you
add subsequent simple expressions, they too are inserted under
Expressions. Multiple simple expressions are
separated by a selection box listing available operators. You can now
edit the expression, with any of the following options:

To change the operator, select the appropriate operator from
the list.

To group two or more expressions, select the check boxes
adjacent to the expressions you want to group. Click
Combine.

To ungroup two or more expressions, select the check boxes
adjacent to the expressions you want to ungroup. Click
Uncombine.

To move one or more expressions up or down, select the check
box(es) adjacent to the expression(s) you want to move. Click
Move Up or Move
Down.

To delete one or more expressions, select the check box(es)
adjacent to the expression(s) you want to delete. Click
Remove.

To negate one or more expressions, select the check box(es)
adjacent to the expression(s) you want to negate. Click
Negate.

Click Save.

To activate these changes, in the Change Center of the Administration Console, click Activate Changes. Not all changes take effect immediately—some require a restart (see Use the Change Center).